## `prepare()` the right way

Things that don't need prepare: Default objects from `$wpdb` (make a dump to see what it got)

* Everything that's built into core: Table names, "Field", Row & Column names

Everything else **must** get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

* `%s` = strings
* `%d` = digits

## Example

Try it like this:

    // functions.php
    function wpse73348_custom_table_query_test( $dump = false )
    {
        global $wpdb;
        $result = $wpdb->query( $wpdb->prepare(
             "
                SELECT * FROM `%s`
                WHERE `code` = `%s`
             "
            ,$wpdb->get_blog_prefix().'fxbase '
            ,$code
        ), ARRAY_A );
        empty( $result ) AND $result = 'No result from query';
    
        if ( ! $dump )
            return $result;
    
        // Debug result
        echo '<pre>'.var_dump( $result, true )
             "\n Rows: \n".var_dump( $result->num_rows, true ).'</pre>';
    }
    
    // some template.php
    wpse73348_custom_table_query_test( true );